CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-5017 – WhatsUp Gold AppProfileImport path traversal vulnerability
https://notcve.org/view.php?id=CVE-2024-5017
In WhatsUp Gold versions released before 2023.1.3, a path traversal vulnerability exists. A specially crafted unauthenticated HTTP request to AppProfileImport can lead can lead to information disclosure. En las versiones de WhatsUp Gold lanzadas antes de 2023.1.3, existe una vulnerabilidad de Path Traversal. Una solicitud HTTP no autenticada especialmente manipulada para AppProfileImport puede dar lugar a la divulgación de información. • https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024 https://www.progress.com/network-monitoring https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1932 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2024-5016 – WhatsUp Gold OnMessage Deserialization of Untrusted Data Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2024-5016
In WhatsUp Gold versions released before 2023.1.3, Distributed Edition installations can be exploited by using a deserialization tool to achieve a Remote Code Execution as SYSTEM. The vulnerability exists in the main message processing routines NmDistributed.DistributedServiceBehavior.OnMessage for server and NmDistributed.DistributedClient.OnMessage for clients. En las versiones de WhatsUp Gold lanzadas antes de 2023.1.3, las instalaciones de Distributed Edition se pueden explotar mediante el uso de una herramienta de deserialización para lograr una ejecución remota de código como SYSTEM. La vulnerabilidad existe en las rutinas principales de procesamiento de mensajes NmDistributed.DistributedServiceBehavior.OnMessage para el servidor y NmDistributed.DistributedClient.OnMessage para los clientes. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software WhatsUp Gold. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of OnMessage method. • https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024 https://www.progress.com/network-monitoring • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-5015 – WhatsUp Gold SessionControler Server-Side Request Forgery Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2024-5015
In WhatsUp Gold versions released before 2023.1.3, an authenticated SSRF vulnerability in Wug.UI.Areas.Wug.Controllers.SessionControler.Update allows a low privileged user to chain this SSRF with an Improper Access Control vulnerability. This can be used to escalate privileges to Admin. En las versiones de WhatsUp Gold lanzadas antes de 2023.1.3, una vulnerabilidad SSRF autenticada en Wug.UI.Areas.Wug.Controllers.SessionControler.Update permite a un usuario con pocos privilegios encadenar esta SSRF con una vulnerabilidad de control de acceso inadecuado. Esto se puede utilizar para escalar privilegios a Administrador. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Progress Software WhatsUp Gold. • https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024 https://www.progress.com/network-monitoring • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-5014 – WhatsUp Gold GetASPReport Server-Side Request Forgery Information Disclosure
https://notcve.org/view.php?id=CVE-2024-5014
In WhatsUp Gold versions released before 2023.1.3, a Server Side Request Forgery vulnerability exists in the GetASPReport feature. This allows any authenticated user to retrieve ASP reports from an HTML form. En las versiones de WhatsUp Gold lanzadas antes de 2023.1.3, existe una vulnerabilidad de Server Side Request Forgery en la función GetASPReport. Esto permite que cualquier usuario autenticado recupere informes ASP desde un formulario HTML. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Progress Software WhatsUp Gold. • https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024 https://www.progress.com/network-monitoring • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-5013 – WhatsUp Gold InstallController Denial-of-Service Vulnerability
https://notcve.org/view.php?id=CVE-2024-5013
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Denial of Service vulnerability was identified. An unauthenticated attacker can put the application into the SetAdminPassword installation step, which renders the application non-accessible. En las versiones de WhatsUp Gold lanzadas antes de 2023.1.3, se identificó una vulnerabilidad de denegación de servicio no autenticada. Un atacante no autenticado puede colocar la aplicación en el paso de instalación SetAdminPassword, lo que hace que la aplicación no sea accesible. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Progress Software WhatsUp Gold. • https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024 https://www.progress.com/network-monitoring • CWE-400: Uncontrolled Resource Consumption •